Legality Of Use Of Leaked Data (Data Protection Act?)

[wessexmario]

A company is a data controller, and by mistake releases to one of their customers, the name and address of another of their customers.

(we know the company is breaking the data protection act by releasing that personal data to someone who doesn't need to have it,... but )

If the customer receiving that information uses it to contact the second customer (the reason is for their mutual non-commercial benefit), is the first committing any sort of offence?

[woofgang]

what an interesting question.....

[EDDIE51]

Happened to me recently, housing association sent me another tenants rent statement. I just handed it back though, can't see what I could have done with it.

[Peter Pedant]

You basically have to be the person whose data is misused
and then you complain to the Information Commissioner

who is here
https://ico.org.uk/

and for clarity !! a company isnt a data controller but HAS a data controller thro whom all data access requests and FIO ( if applicable ) should be addressed.

This is civil and I am pretty sure that you cant do third party complaints
various sections of the data protection act involve criminal liability
but forget it - snow will fall in summer before you can get someone to act on it.

[Peter Pedant]

// I just handed it back though, can't see what I could have done with it. //
ed you should have pointed out that the association should be more careful - and they wont thank you for it....

I had a council rat notice - but not in the name of my tenant who had the rats but the (anonymous) complainant - so it was unenforceable as it was in the wrong name and address .....
but I didnt take it to the wire - I think if they had turned up with TV cameras etc I might have -
but took the hint and did the rat thing
I thought the anon complainant had a point and my tenant is now and extenant

[wessexmario]

to put the perspective on it, I am the first customer..

[Peter Pedant]

company releasing the data is at fault
and the first customer can complain about a data breach
I still think you should follow the companys complaints procedure

the second company has acquired data
I would not say unlawfully - I would say by mistake
does he have a duty of confidence for info he has acquired by mistake ?
I would say no unless it has private and confidential on it
and you have commented:
(the reason is for their mutual non-commercial benefit )
I mean come aaaaaan ! if there is no commercial loss then there really isnt a realistic action .... sorry.

PP